Bug 41440

Summary:	imagemagick: Multiple issues (3.3)
Product:	UCS	Reporter:	Arvid Requate <requate>
Component:	Security updates	Assignee:	Daniel Tröder <troeder>
Status:	CLOSED FIXED	QA Contact:	Arvid Requate <requate>
Severity:	normal
Priority:	P2	Flags:	requate: Patch_Available+
Version:	UCS 3.3
Target Milestone:	UCS 3.3-0-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):	Security
Max CVSS v3 score:
Bug Depends on:	41439
Bug Blocks:

Description Arvid Requate

2016-06-03 09:30:59 CEST

+++ This bug was initially created as a clone of Bug #41439 +++

Upstream Debian package version 8:6.7.7.10-5+deb7u6 fixes this new issue:

* command injection vulnerability. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application (CVE-2016-5118)

Comment 1 Daniel Tröder

2016-06-08 09:20:43 CEST

Update was build to scope errata3.3-0.
Advisory is in r69938.

Comment 2 Arvid Requate

2016-06-09 19:25:57 CEST

* source package version 8:6.7.7.10-5+deb7u6 imported and built
* binary package updatable
* advisory ok

Comment 3 Janek Walkenhorst

2016-06-15 12:09:11 CEST

<http://errata.software-univention.de/ucs/3.3/8.html>